DE102006004240A1 - Method and device for detecting pirated copy - Google Patents

Abstract

The invention relates to a method for detecting a pirated copy, in which a first software comprises a copy of at least part of a second software, the following steps are carried out in which the first software is executed, with a write and / or change taking place during a procedure change. or reading process of a parameter group of a procedure instance to and / or from a stack memory at least one parameter characteristic of this writing and / or reading process is recorded in a first document in a chronological order for the occurrence of the writing and / or reading processes, the second software is carried out, with a write and / or read process of a parameter group of a procedure instance to or from a stack memory taking place during a procedure change at least one parameter characteristic of this write and / or read process in a for an occurrence of the write and / or Read processes timed chen sequence is recorded in a second document, the at least one correlation value is formed by correlating at least one of the characteristic parameters of at least one section of the second document with at least one of the associated characteristic parameters of at least one section of the first document and the presence of the pirated copy is indicated if the correlation value is greater than a threshold value. The invention also relates to a ...

Description

The The invention relates to a method according to claim 1 and a Device according to the claim 6th

The Development of software poses in the manufacture of products, such as cell phones or cars, a significant Cost factor dar. Since software is easy to copy, for example by copying a CD (Compact Disc Disc), which includes the software to be copied, are created for software manufacturers high sales losses. Besides copying entire software packages, such as a complete operating system CD, too Parts of such software, such as single Dynamic Link Libraries (DLL - Dynamic Link Library) in other software products as pirated copy become.

Of the The invention is based on the object, a method and a device to provide an at least partial copy of a second Software is detected in a first software, the procedure and the device is both robust to changes in the copy as well applicable to existing software.

These Task is by the independent claims solved. Further developments of the invention can be found in the dependent claims.

• a) Ausführen der ersten Software, wobei bei einem während eines Prozedurwechsels stattfindenden Schreib- und/oder Lesevorgang einer Parametergruppe einer Prozedurinstanz auf einen und/oder von einem Stapelspeicher zumindest ein für diesen Schreib- und/oder Lesevorgang charakteristischer Parameter in einer für ein Auftreten der Schreib- und/oder Lesevorgänge zeitlichen Reihenfolge in einem ersten Dokument aufgenommen wird;
• b) Ausführen der zweiten Software, wobei bei einem während eines Prozedurwechsels stattfindenden Schreib- und/oder Lesevorgang einer Parametergruppe einer Prozedurinstanz auf einen und/oder. von einem Stapelspeicher zumindest ein für diesen Schreib- und/oder Lesevorgang charakteristischer Parameter in einer für ein Auftreten der Schreib- und/oder Lesevorgänge zeitlichen Reihenfolge in einem zweiten Dokument aufgenommen wird;
• c) Bilden zumindest eines Korrelationswerts durch Korrelation zumindest einer der charakteristischen Parameter zumindest eines Abschnitts des zweiten Dokuments mit zumindest einem der dazugehörigen charakteristischen Parameter zumindest eines Abschnitts des ersten Dokuments;
• d) Anzeige eines Vorhandenseins der Raubkopie, falls der Korrelationswert größer als ein Schwellenwert ist.

In a method of detecting a pirated copy in which a first software comprises a copy of at least part of a second software, the following steps are performed.

• a) executing the first software, wherein in a occurring during a procedure change writing and / or reading a parameter group of a procedure instance on and / or from a stack at least one characteristic of this writing and / or reading operation parameters in one for an occurrence of Write and / or read temporal order is recorded in a first document;
• b) executing the second software, wherein at a taking place during a procedure change writing and / or reading a parameter group of a procedure instance on and / or. at least one parameter characteristic of this writing and / or reading process is recorded in a second document by a stack memory in a chronological order for an occurrence of the writing and / or reading operations;
• c) forming at least one correlation value by correlating at least one of the characteristic parameters of at least a portion of the second document with at least one of the associated characteristic parameters of at least a portion of the first document;
• d) indicating the presence of piracy if the correlation value is greater than a threshold.

This Procedure allows a pirated copy of a second software or parts of a second software in a first software by recording characteristic parameters while the respective execution demonstrated. This is done by using the correlation value allows that despite changes in the first software opposite the second software the pirated copy is nevertheless recognized, because of the Correlation value a similarity describes two sections of the first and the second software. On the other hand, there are no changes in the first or second software required because the recording or capture of the characteristic Parameter by means of a stand-alone Program, which evaluates functions of the operating system, take place can. Thus, even existing software can be examined for pirated copies.

• – Anzahl an Variablen einer aufgerufenen Prozedurinstanz;
• – Anzahl an Bytes der Variablen der aufgerufenen Prozedurinstanz;
• – Anzahl an lokalen Variablen einer aufrufenden Prozedurinstanz;
• – Anzahl an Bytes der lokalen Variablen der aufrufenden Prozedurinstanz;
• – Angabe, ob ein rekursiver Aufruf zwischen aufgerufener und aufzurufender Prozedurinstanz stattfindet;
• – Angabe einer jeweiligen Speicheradresse der aufgerufenen und/oder der aufzurufenden Prozedurinstanz.

Preferably, a value of the parameter group and / or an execution time of the procedure change are used as the characteristic parameter. By using one of the values of the parameter group, specific behavioral properties of the procedure instance to be invoked and / or invoked can be accurately analyzed. Using the execution time, a time chart can be created indicating when the procedure change occurred. With the aid of these characteristic parameters, a characteristic behavior of the procedure instances can be described in detail. In particular, the following characteristic parameters of the parameter group can be used:

• - number of variables of a called procedure instance;
• - Number of bytes of the variables of the called procedure instance;
• - number of local variables of a calling procedure instance;
• Number of bytes of the local variables of the calling procedure instance;
• - Specifies whether a recursive call takes place between the called and the invoked procedure instance;
• - Specification of a respective memory address of the called and / or the procedure instance to be called.

These characteristic parameters of the parameter group can be found in be easily detected at the procedure change.

Preferably be several sections of the second document with the associated characteristic Parameters correlated at least with a portion of the first document and from it for each correlated section of the second document as a result an associated Correlation value formed and a copy displayed, if a plurality the correlation values are greater than is a respective threshold. Thus, a reduction of a Rate of erroneously detected pirated copies can be achieved because more than one correlation value for the Determining whether pirated or not pirated is considered becomes.

In an alternative training will be several sections of the second Document with the corresponding Characteristic parameters with at least a portion of first document correlates and therefrom for each correlated section of the second document, as a result, an associated correlation value is formed and display a copy if at least one of the correlation values greater than a first threshold and the other correlation values, respectively greater than a second threshold. This alternative also allows a reduction by mistake detected pirated copies.

• – einem ersten Mittel zum Ausführen der ersten Software, wobei bei einem während eines Prozedurwechsels stattfindenden Schreib- und/oder Lesevorgang einer Parametergruppe einer Prozedurinstanz auf einen und/oder von einem Stapelspeicher zumindest ein für diesen Schreib- und/oder Lesevorgang charakteristischer Parameter in einer für ein Auftreten der Schreib- und/oder Lesevorgänge zeitlichen Reihenfolge in einem ersten Dokument aufgenommen wird;
• – einem zweiten Mittel zum Ausführen der zweiten Software, wobei bei einem während eines Prozedurwechsels stattfindenden Schreib- und/oder Lesevorgang einer Parametergruppe einer Prozedurinstanz auf einen und/oder von einem Stapelspeicher zumindest ein für diesen Schreib- und/oder Lesevorgang charakteristischer Parameter in einer für ein Auftreten der Schreib- und/oder Lesevorgänge zeitlichen Reihenfolge in einem zweiten Dokument aufgenommen wird;
• – einem dritten Mittel zum Bilden zumindest eines Korrelationswerts durch Korrelation zumindest einer der charakteristischen Parameter zumindest eines Abschnitts des zweiten Dokuments mit zumindest einem der dazugehörigen charakteristischen Parameter zumindest eines Abschnitts des ersten Dokuments;
• – einem vierten Mittel zum Vergleichen des zumindest einen Korrelationswert mit zumindest einem Schwellenwert;
• – einem fünften Mittel zum Anzeige eines Vorhandenseins der Raubkopie, falls der Korrelationswert größer als ein Schwellenwert ist.

The invention also relates to a device for detecting a pirated copy, in which a first software comprises a copy of at least part of a second software, with

• A first means for executing the first software, wherein during a procedure change takes place writing and / or reading operation of a parameter group of a procedure instance on and / or from a stack at least one characteristic of this writing and / or reading operation parameters in a for an occurrence of the writing and / or reading operations in chronological order is recorded in a first document;
• A second means for executing the second software, wherein, during a write and / or read operation of a parameter group of a procedure instance to and / or from a stack memory, at least one parameter characteristic of this writing and / or reading process is stored in one for a an occurrence of the writing and / or reading in chronological order is recorded in a second document;
• A third means for forming at least one correlation value by correlating at least one of the characteristic parameters of at least a portion of the second document with at least one of the associated characteristic parameters of at least a portion of the first document;
• A fourth means for comparing the at least one correlation value with at least one threshold value;
• - a fifth means for indicating the presence of the pirated copy, if the correlation value is greater than a threshold value.

With Using this device, the method is implementable and executable. The Method and the device can as hardware, as software running on a processor or as Combination of hardware and software.

The Invention and its developments are described below with reference to the Drawing closer explains:

It demonstrate:

1 a program flow of a software in which several procedure units are called;

2 an occupancy of a stack during a program flow;

3 a flowchart of an embodiment;

4A , B, C, D are sections of a filling level of the stack for a first and a second software, a pattern to be searched within the respective fill levels of the stack and distribution of the correlation value over time;

5 an apparatus for performing the method for detecting a pirated copy.

Elements with the same function and mode of action are in the 1 to 5 provided with the same reference numerals.

In 1 is a program flow of a software to see. The software is in the form of a sequence of machine instructions and is executed, for example, on a microprocessor or a digital signal processor. This machine command software can be created by compiling and linking a C program using a development package such as Microsoft Visual Studio.

The Software can be divided into multiple procedure instances PI. Within each procedure instance PI, machine instructions become sequential executed. It will be during or other procedure instances at the end of each procedure instance called, i. a procedure change takes place. These calls cause data, such as register contents of the microprocessor read or written from one or to a stack become.

The procedure change with the read and write operations LV, SV are based on the 1 explained in more detail. In this case, a second procedure instance PI2 is called during the course of a first procedure instance PI1. In this case, the register contents of the microprocessor are written to the stack memory SP by means of the write operation SV at the time before the procedure change. Furthermore, values of local variables of the first procedure instance PI1 can also be stored on the stack. In general, a parameter group PG of the procedure instance PI, PI1 is written to or read from the stack SP. In this embodiment, the parameter group PG includes the register contents and local variables of the first procedure instance PI1. Furthermore, the first procedure instance PI1 represents a calling procedure instance and the second procedure instance PI2 represents an invoked procedure instance.

To Calling the second procedure instance PI2 will be the individual machine commands the second procedure instance processed. Upon reaching the end the second procedure instance PI2 returns the program flow to the first Procedure instance PI1 back. At the time of the procedure change from the first to the second procedure instance stored data from the stack SP read by reading LV. These read data include For example, register contents contained in the corresponding registers written by the microprocessor or even local content Data associated with the local variables of a procedure instance PI1 become.

After further machine instructions have been executed within the first procedure instance PI1, the following is intended to jump to a third procedure instance PI3. In this case, during the change from the first to the third procedure instance, a write operation SV according to the above description takes place. Within the third procedure instance, a fourth procedure instance PI4 is called, whereby again a writing process SV is executed. Upon completion of the program flow of the fourth procedure instance PI4, the third procedure instance PI3 is jumped back, whereby a read operation is performed. This third procedure instance PI3 is continued to its end and then, with the aid of another read operation, the first procedure instance PI1 is called. During the respective procedure changes, the data belonging to the respective procedure instances are written to the stack SP or read from the stack SP. These read and write operations LV, SV are in 1 symbolically represented by arrows, with the aid of these arrows, the jumps carried out during the program execution of the software between the procedure instances PI are reproduced. The use of stacks is known to a person skilled in the art, see for example [1].

With the help of 2 In the following, a fill level of the stack during the execution of a software with the individual procedure instances over a time axis T will be explained in greater detail. The individual procedure instances PI1,..., PI4 were used in the exemplary embodiment according to FIG 1 called in the following order:
PI1 → PI2 → PI1 → PI3 → PI4 → PI3 → PI1.

This sequence of the individual procedure instances is in the lower part of the picture 2 printed. In the upper part of the picture 2 is a level diagram with the level F of the stack SP as a function of the flow of the software, that is, depending on the executed procedure instances reproduced. The fill level F is given, for example, in bytes, with each graduation mark of the fill level F in 2 each corresponds to 100 bytes. Thus, for example, when the second procedure instance PI2 is called by the write operation SV, 250 bytes are written to the stack memory. Upon completion of the second procedure instance PI2, in the following read operation LV, the 250 bytes are read from the stack. Both subsequent procedure changes are handled in an analogous manner. In the filling level diagram of the stack it can be seen that during a writing process the filling level of the stack increases, whereas in a reading process the filling level is reduced.

The method according to the invention detects characteristic parameters CP1,..., CP4 for those execution times AZ at which a procedure change takes place. These characteristic parameters represent specific properties of the calling and / or the called procedure instance. The characteristic parameters may, for example, correspond to one or more values of the parameter group PG, such as a specific register content. Furthermore, a characteristic parameter can also be generated from a summary or evaluation of the parameter group PG detected for the procedure change. Here, a first characteristic parameter CP1 may correspond to a number of bytes of all local variables of the calling procedure instance PI1. In the embodiment according to 1 During the procedure change from PI1 to PI2 250 bytes were written to the stack. These 250 bytes include, for example, 64 bytes comprising the register values and 186 bytes including values of the local variables of the first procedure instance PI1. Thus, the first characteristic parameter CP1 describes the number of bytes of the local variables of the first procedure instance PI1, that is, the calling procedure instance, which in the present embodiment is CP1 = 186.

A Detecting the parameter group PG is realized, for example, by that when calling a function of the software that the read or Write operation LV, SV performs, Data of the calling and / or the called procedure instance, this means the parameter group, are detected. Furthermore, in the context of the implementation of the Method only a part of the parameter group or also an information, by evaluating one or more data of the parameter group is obtained. The one in a read or write obtained data or information are in a document for later further processing organized. Furthermore, it is useful in practice, too each stored information or stored data the execution time the recording of this information or data to log. In general, this information becomes a procedure change can be assigned, referred to as characteristic parameters CP1, ..., CP4.

In 3 a flowchart for an embodiment is shown. After the start of the flowchart in state STA, a first document D1 for the first software S1 is generated with the aid of the first step X1. In the first step X1, during the execution of the first software S1 during writing and / or reading operations, at least one first characteristic parameter CP1 for the procedure change is detected in the first document D1. For example, the first document may include the level F of the stack SP over the time of executing the first software. This is already based on 2 has been explained in detail. The first document can display level F over time in the following form:

The first line of this table gives the execution times AZ above the Time T for example in milliseconds ms. The second line reflects the level the stack in bytes again. This includes the level between 0 and 40 ms 0 bytes, between 40 and 80 ms 250 bytes etc.

In a second step X2, a second document D2 is generated for the second software S2. The procedure is analogous to the first step X1. The representation of the second document D2 is analogous to the first document D1. In a third step X3, a correlation value KW is formed by correlating the at least one characteristic parameter CP1 of at least one section of the second document D2 with at least one of the characteristic parameters CP1 of at least one section of the first document D1. The correlation value KW indicates the extent to which correlated portions of the first and second documents D1, D2 are similar. A typical procedure of the third step for forming the correlation value KW is described below with reference to FIG 4 detailed. 4A shows the progress of the fill level of the stack when running the first software over time T. This history is stored in the first document. 4B shows a further course of the stack in the execution of the second software S2. This history is stored in the second document. To form the correlation value KW, a first section A1 becomes out in the course of the filling level F. 4A selected. This selected first section A1 is in 4C played. Within the course of the level that results when running the second software S2, see 4B , now this first section A1 is searched. For this purpose, statistical methods are familiar to a person skilled in the art, with the aid of which the course of the fill level of the first section A1 with the fill level profile 4B can be correlated. This results, as in 4D shown at the time point T1 a high correlation value. At the times that do not correspond to the first time T1, there are correlation values that are 0 or small.

As in 4D can be seen, exceeds the first time T1, the correlation value KW a predetermined threshold SW. For example, the threshold SW = 0.5 and the correlation value KW = 0.75. Thus, in the level history that arises when executing the second software S2, a similar behavior of the second software as when executing the first software has been discovered.

As in 3 indicated in a fourth step, at least one of the correlation value KW generated in the third step X3 is compared with a predefinable threshold SW. If the correlation value KW is greater than the threshold SW, the flowchart in the path J is continued. In this path, in a fifth step X5, for example, a user is notified that a correlation value greater than the threshold has been found. This means that at least part of the first software could be found in the second software S2 and thus at least parts of the first software from the second software have been copied, ie a pirated copy has thus been discovered. The fifth step is then ended in the END state.

finds However, in the fourth step X4 no correlation value KW, the greater than is the predetermined threshold SW, the flowchart becomes continued in the path N, which the flowchart in the state END terminated.

In the present embodiment, a portion of the progress of the filling level of the stack when executing the first software has been compared with the history of the level when executing the second software. In general, a section to be compared may be used instead of the fill level history of the first software also from the level history of the second software. This is exemplified by a second section A2 in FIG 4B played. In general, at least a similarity of a portion of the first and second documents in the second or first document is sought.

Of Furthermore, it is useful in practice, several sections in the second document D2 for which there is a correlation with Sections of the first document D1 should be performed. Only when for many Sections of the second document a correlation value is found the bigger than is a definable threshold SW, in step X5 the user is shown that the first software is a pirated copy of the second software.

In the embodiment according to 4 The level of the stack was used over the execution time of each software. In general, a wide variety of characteristic parameters CP1,..., CP4 can be used, which characterize a procedure change. In addition to the level of the stack, a number of variables of the called procedure instance, a number of bytes of variables of the called procedure instance, a number of local variables of a calling procedure instance, a number of local variables of a calling procedure instance, or a number of bytes of local variables the calling procedure instance are considered as characteristic parameters. Furthermore, alternatively or additionally, as characteristic parameters an indication can be used which indicates whether the procedure change corresponds to a recursive call or the respective memory addresses of the called and / or the procedure instance to be called are used.

Furthermore, combinations of characteristic parameters can also be taken into account in the formation of the correlation value. For example, in addition to the pure level of the stack, a number of variables of the called procedure instance are taken into account. Thus, the correlation value describes a correlation of a plurality of characteristic parameters, which are correlated separately, for example, and linked to a correlation value by means of a weighted addition. The skilled person is familiar with further statistical methods for carrying out correlations with one or more characteristic parameters, so that this will not be discussed further. If a plurality of correlation values KW1, KW2, KW3 are used, a pirated copy is displayed if a plurality of correlation values are each greater than an associated threshold value. The following numerical example illustrates this:
KW1 = 0.5; KW2 = 0.3; KW3 = 0.25
SW1 = 0.4; SW2 = 0.4; SW3 = 0.4

in this connection is only the second correlation value KW2> SW2, so that no pirated copy is detected becomes. If SW3 = 0.2, then KW2> SW2 and KW3> SW3. So a pirate copy is detected.

In an alternative embodiment a pirated copy is already detected if at least one of the correlation values greater than the associated one Threshold is. For the 2 examples mentioned in the above paragraph mean that for each Example, a pirated copy is detected.

• a) Soll eine Übereinstimmung zwischen zu vergleichenden Abschnitten der ersten und der zweiten Software sehr genau sein, so wird der jeweilige Schwellenwert nahe dem maximalen Korrelationswert gewählt. Hierbei ist zu beachten, dass kleine Änderungen, z.B. aufgrund von Änderungen der Maschinenbefehle in den Abschnitten oder wegen Laufzeitschwankungen während des Ausführens der ersten und zweiten Software, einen niedrigen Korrelationswert d.h. eine niedrige Ähnlichkeit, ergibt und somit kopierte Abschnitte bzw. die Raubkopie nicht erkannt wird.
• b) Wird ein niedriger Schwellenwert SW als der maximale Korrelationswert ausgewählt, so können Raubkopien auch dann nachgewiesen werden, wenn Änderungen im Laufzeitverhalten der Abschnitte der ersten und zweiten Software auftreten. Wird der Schwellenwert zu niedrig gewählt, so werden Ab schnitte als Kopien erkannt, die in Wirklichkeit keine Kopien sind.

A selection of the threshold (s) SW, S1, ..., SW3 depends on the following aspects:

• a) If a match between sections of the first and the second software to be compared is to be very accurate, the respective threshold value is chosen close to the maximum correlation value. It should be noted that small changes, eg due to changes in the machine instructions in the sections or due to runtime fluctuations during the execution of the first and second software, a low correlation value ie a low similarity results, and thus copied sections or pirated copy is not recognized ,
• b) If a low threshold SW is selected as the maximum correlation value, pirate copies can be detected even if changes occur in the runtime behavior of the sections of the first and second software. If the threshold is set too low, sections will be recognized as copies that are not actually copies.

takes the correlation value KW, for example, a value range of -1 to 1 a, where the value is 1 exact match and the value -1 full Disagreement represents, for example, a value of KW = 0.8 a low rate with an indication of one mistakenly detected pirated copy and at the same time this value allows a tolerance against small changes in machine code and against changes in the runtime behavior. A concrete threshold SW depends, for example. from the runtime behavior of a computer on which the first and run second software becomes. If the computer uses a multitasking operating system, then can changes occur in runtime behavior, so that in this case a lower Threshold is set as with a real-time operating system.

5 shows an embodiment of the device in the form of a device G, which is designed for example as a portable device in a mobile device or as a stationary operated device. The device G has a first means M1, with which the first software S1 is executed. During the procedure change during writing and / or reading operations, characteristic parameters are recorded in a first document D1. In the second means M2, the second software S2 is executed. During execution, characteristic parameters are detected in a write and / or read operation of the parameter group of a procedure instance in a second document D2. The second document can be read or written by means of the connection network X. One or more correlation values KW1,..., KW3 are recorded in the third means M3 on the basis of the acquired information of the first and the second document. These ascertained correlation values are compared in the fourth means M4 with one or more predefinable threshold values SW1,..., SW4. Should one or more correlation values be greater than the respective threshold value, then with the aid of the fifth means M5 the presence of the copy, that is to say that at least sections of the first software are almost or completely identical to sections of the second software, can be displayed. This display can be reproduced, for example, for a user on a display DD. The means M1, ..., M5, the first and second documents D1, D2, the stack SP and the display DD are connected to each other via the connection network X for the exchange of information and data.

literature

• [1] Stack Memory, Wikipedia Encyclopedia, see http://de.wikipedia.org/wiki/stack

Claims (6)

A method for detecting a pirated copy, wherein a first software (S1) comprises a copy of at least a part of a second software (S2), comprising the following steps: a) executing the first software (S1), wherein a write operation occurring during a procedure change and / or reading a parameter group (PG) of a procedure instance (PI) on and / or from a stack memory (SP) at least one parameter (CP1, ..., CP4) characteristic of this writing and / or reading process in one of a Occurrence of the writing and / or reading chronological order in a first document (D1) is recorded; b) executing the second software (S2), wherein at least one of a parameter group (PG) of a procedure instance (PI) on one and / or of a stack memory (SP) is read and / or read during a procedure change. and / or reading of characteristic parameters (CP1, ..., CP4) in a chronological order for occurrence of the writing and / or reading operations recorded in a second document (D2); c) forming at least one correlation value (KW) by correlation of at least one of the characteristic parameters (CP1) of at least a portion of the second document (D2) with at least one of the associated characteristic parameters (CP1) of at least a portion of the first document (D2); d) indicating the presence of piracy if the correlation value (KW) is greater than a threshold value (SW). Method according to claim 1, characterized in that that as characteristic parameter (CP1, ..., CP4) a value of Parameter group (PG) or execution time (AZ) of the procedure change is used. Method according to claim 2, characterized, that at least one of the following parameters from the parameter group (PG) is included: - Number at variables of a called procedure instance (PI1); - Number bytes of the variables of the called procedure instance (PI1); - Number on local variables of a calling procedure instance (PI2); - Number bytes of the local variables of the calling procedure instance (PI2); - Specification, whether a recursive call between invoked and invoked Procedure instance (PI1, PI2) takes place; - Specification of a respective memory address the called and / or the procedure instance to be called (PI1, PI2). Method according to one of claims 1 to 3, characterized, that several sections of the second document (D2) with the associated characteristic parameters (CP1) at least with a section of the first document (D1) correlates with and for each Correlated section of the second document (D2) as a result Related Correlation value (KW1, KW2, KW3) is formed, a copy is displayed if a plurality of the correlation values (KW1, KW2, KW3) greater than is a respective threshold (SW1, SW2, SW3). Method according to one of claims 1 to 3, characterized, that several sections of the second document (D2) with the associated characteristic parameters (CP1) with at least one section of the first document (D2) correlates and for each Correlated section of the second document (D2) as a result Related Correlation value (KW1, KW2, KW3) is formed, a copy is displayed if at least one of the correlation values (KW1) greater than a first threshold (SW1) and the other correlation values (KW2, KW3) each greater than a second threshold (SW2). Device for detecting a pirated copy, in which a first software (S1) comprises a copy of at least part of a second software (S2), in particular for carrying out a method according to one of the preceding claims, having - a first means (M1) for carrying out the first software (S1), wherein at a taking place during a procedure change writing and / or reading a parameter group (PG) of a procedure instance (PI) on one and / or from a stack (SP) at least one for this writing and / or reading characteristic parameter (CP1, ..., CP4) in a time sequence for occurrence of the writing and / or reading operations in a first document (D1) is receivable; - A second means (M2) for executing the second software (S2), wherein at a taking place during a procedure change writing and / or reading a parameter group (PG) of a procedure instance (PI) to or from a stack (SP) at least a parameter (CP1, ..., CP4) characteristic of this writing and / or reading process can be recorded in a second document (D2) in a chronological order for an occurrence of the writing and / or reading operations; - Third means (M3) for forming at least one correlation value (KW) by correlation of at least one of the characteristic parameters (CP1) at least a portion of the second document (D2) with at least one of the associated characteristic parameters (CP1) at least a portion of the first document (D2); A fourth means (M4) for comparing the at least one correlation value (KW) with at least one Threshold (SW); - a fifth means (M5) for indicating the presence of the pirated copy, if the correlation value (KW) is greater than a threshold value (SW).